The European Data Protection Supervisor (EDPS) has ruled that the European Commission violated EU privacy laws when it used targeted advertising on social media platform X (formerly Twitter) to promote its proposed chat control regulation.
According to the EDPS decision issued on December 13, 2024, the Commission unlawfully processed personal data, including sensitive information about users' political views and religious beliefs, during an advertising campaign that ran from September 15-28, 2023.
The investigation revealed that the Commission specifically targeted Dutch-speaking users from the Netherlands while excluding those who had interacted with certain keywords like "brexit," "Marine Le Pen," "Alternative für Deutschland," and religious terms. The advertisements, which were shown over 600,000 times, promoted the Commission's proposed regulation on preventing child sexual abuse.
"The Commission has not demonstrated that the processing of special categories of personal data in the context of a targeted advertising campaign was justified as necessary for exercising its right of initiative," stated the EDPS in its decision.
The case was initiated by privacy advocacy group noyb, which filed a complaint in November 2023. Felix Mikolasch, Data Protection Lawyer at noyb, noted: "Since Cambridge Analytica it is clear that targeted ads can influence democracy. Using political preferences for ads is clearly illegal."
The EDPS found that the Commission infringed multiple articles of Regulation (EU) 2018/1725, including those governing lawful data processing and the handling of sensitive personal data. While the Commission claimed it was acting under its mandate to communicate about legislative proposals, the EDPS determined this did not provide adequate legal basis for processing sensitive personal data.
As a corrective measure, the EDPS issued a formal reprimand to the Commission. The supervisor considered this an appropriate and proportional measure since the Commission had already stopped the campaign in question.
The decision establishes an important precedent for how EU institutions can use social media advertising, particularly when it comes to targeting based on political views. The ruling may also influence pending investigations into similar practices by political actors in EU member states.
The Commission has three months to inform the EDPS of measures taken in response to the decision. Under EU law, the Commission can challenge the ruling before the Court of Justice of the European Union within two months.